events-pumps[.]org

On 24 July 2026, the domain events-pumps.org was identified as hosting a generic phishing page. The site resolves to the IPv6 address 2606:4700:3030::6815:269, which is allocated to Cloudflare, Inc. (AS13335) and geolocated to the United States. The domain was registered on 6 August 2025 through NameSilo, LLC. The page title returned by the HTTP request is “Nur einen Moment…”, indicating the site presents a German‑language waiting message, but no further content has been captured. The TLS certificate is listed as “WE1”, and the domain has a Gridinsoft trust score of 0 out of 100, reflecting an extremely low reputation.

Threat intelligence platforms have flagged the domain; 1 of 93 security vendors on VirusTotal reported it as malicious, and it appears on a single external blocklist. PhishDestroy has actively blocked the address, and the current operational status is offline, suggesting the phishing infrastructure has been taken down or is no longer serving content. Analysis indicates that the domain is part of a short‑lived phishing campaign, likely leveraging Cloudflare’s CDN to hide the true backend server.

The lack of additional public detections beyond a single blocklist entry limits insight into the broader campaign scope. Defenders should continue to monitor the IPv6 address and the domain for any re‑appearance, enforce blocklisting of the address in perimeter defenses, and ensure that any email or web traffic referencing events-pumps.org is quarantined. Because the site is currently offline, immediate incident response actions such as takedown requests are unnecessary, but organizations should retain the indicator of compromise (IOC) for future correlation with phishing emails or credential‑harvesting attempts.